JP2010287009A - Apparatus and program for processing information - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an information processing apparatus extracting past risk in business activities having possibility of concerning a new regulation document when the regulation document occurs. <P>SOLUTION: A regulation characteristic amount storage means of this information processing apparatus stores a characteristic amount related to a regulation sentence inside the regulation document, and association between the regulation sentence and risk information. A document component extraction means extracts a document component constituting the document from the document related to a regulation. A document component characteristic amount calculation means calculates a characteristic amount of the extracted document component. A similarity calculation means calculates similarity between the calculated characteristic amount of the document component and the characteristic amount stored in the regulation characteristic amount storage means. A risk information extraction means extracts the regulation sentence similar to the document component extracted by the document component extraction means based on the similarity calculated by the similarity calculation means, and extracts the risk information related to the regulation sentence based on the association. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an information processing apparatus and an information processing program.

  Risk management is systematically performed as part of corporate control activities. In order to systematically manage the risk, it is necessary to extract the risk from the business process and define how to control the risk. A system for supporting this work has been proposed.

  As a technology related to this, for example, in Patent Document 1, a general document concept information extraction unit extracts a general document from a general document with the task of promoting the awareness of the risk management person and improving the efficiency of the risk discovery process. General document concept information stored in the concept information storage unit, risk case document concept information extracted by the risk case document concept information extraction unit and stored in the risk case document concept information storage unit, and input by the risk manager It is disclosed that the concept information synthesis unit synthesizes new concept information that prompts the user to notice using the concept information of the seed sentence extracted by the seed sentence analysis unit and outputs it to the concept information output unit.

  Further, for example, Patent Document 2 has an object to support optimization of management contents for reducing risk of business activities, and an RCM (risk control control) from a user terminal device through a communication interface of a document data check device. When the (matrix) is received, the document data check unit, among the matching expressions on the single cell rule database stored in the storage device, the user associated with the matching expression that matches the expression in each word of RCM and each phrase. The message generation unit generates display balloon information including the read message, and the communication interface transmits the display balloon information generated by the message generation unit to the user terminal device to display the screen. Is disclosed.

JP 2006-023789 A JP 2008-033887 A

  An object of the present invention is to provide an information processing apparatus and an information processing program for extracting a past risk in a business activity that may be related to a regulation document when a new regulation document is generated. .

The gist of the present invention for achieving the object lies in the inventions of the following items.
The invention of claim 1 comprises a rule feature quantity storage means for storing a feature quantity relating to a rule sentence in the rule document and an association between the rule sentence and risk information, and a document relating to the rule. A document part extracting unit for extracting a document part, a document part feature amount calculating unit for calculating a feature amount of the document part extracted by the document part extracting unit, and a document part calculated by the document part feature amount calculating unit. Similarity calculation means for calculating the similarity between the feature quantity and the feature quantity stored in the prescribed feature quantity storage means, and the document part extraction means based on the similarity calculated by the similarity calculation means. It comprises a risk information extracting means for extracting a rule sentence similar to the extracted document part and extracting risk information related to the rule sentence based on the association. Is an information processing apparatus to be.

  The invention of claim 2 further comprises risk-related information storage means for storing information relating to correspondence between control and risk, and importance of risk, and the rule feature quantity storage means is for creating items related to control. The feature amount related to the rule text in the rule document as a basis, and the relation between the rule text and the control are stored, and the risk extracting means is configured to store the rule based on the similarity calculated by the similarity calculation means. The control related to the rule sentence is extracted from the feature amount storage means, the risk corresponding to the control is extracted from the risk-related information storage means, and extracted by the document part extraction means based on the importance of the risk The information processing apparatus according to claim 1, wherein a risk associated with a document part is extracted.

  In the invention of claim 3, the risk-related information storage means stores a risk influence degree or possibility of occurrence, and the risk extraction means stores a risk influence degree stored in the risk-related information storage means. The information processing apparatus according to claim 2, wherein the importance level of the risk is determined based on the possibility of occurrence.

  According to a fourth aspect of the present invention, a computer comprises a rule feature quantity storage means for storing a feature quantity relating to a rule sentence in a rule document and an association between the rule sentence and risk information, and a document relating to the rule. A document part extracting unit that extracts a document part, a document part feature amount calculating unit that calculates a feature amount of the document part extracted by the document part extracting unit, and a document part feature amount calculating unit Similarity calculation means for calculating the similarity between the feature quantity of the document part and the feature quantity stored in the rule feature quantity storage means, and based on the similarity calculated by the similarity calculation means, the document part A risk information extracting unit that extracts a rule sentence similar to the document part extracted by the extracting unit and extracts risk information related to the rule sentence based on the association; An information processing program for causing a function Te.

  According to a fifth aspect of the present invention, a rule feature quantity storage means for storing a feature quantity relating to a rule sentence in the rule document and an association between the rule sentence and control information, and a document relating to the rule are included in the document. A document part extracting unit for extracting a document part, a document part feature amount calculating unit for calculating a feature amount of the document part extracted by the document part extracting unit, and a document part calculated by the document part feature amount calculating unit. Similarity calculation means for calculating the similarity between the feature quantity and the feature quantity stored in the prescribed feature quantity storage means, and the document part extraction means based on the similarity calculated by the similarity calculation means. Control information extraction means for extracting a rule sentence similar to the extracted document part and extracting control information related to the rule sentence based on the association An information processing apparatus characterized by comprising.

  The invention of claim 6 further comprises control-related information storage means for storing information relating to correspondence between control and risk, and importance of control, and the rule feature quantity storage means is for creating items related to risk. The feature amount related to the rule text in the rule document as a basis, and the relation between the rule text and the risk are stored, and the control extraction unit is configured to store the rule based on the similarity calculated by the similarity calculation unit. The risk associated with the rule sentence is extracted from the feature amount storage means, the control corresponding to the risk is extracted from the control related information storage means, and extracted by the document part extraction means based on the importance of the control 6. The information processing apparatus according to claim 5, wherein a control related to the document part is extracted.

  In the invention of claim 7, the control related information storage means stores the influence degree or possibility of occurrence of control, and the control extraction means stores the influence degree of control stored in the control related information storage means. The information processing apparatus according to claim 6, wherein the importance of control is determined based on the possibility of occurrence.

  According to the invention of claim 8, the computer comprises a rule feature quantity storage means for storing a feature quantity related to a rule sentence in the rule document and an association between the rule sentence and control information, and a document related to the rule. A document part extracting unit that extracts a document part, a document part feature amount calculating unit that calculates a feature amount of the document part extracted by the document part extracting unit, and a document part feature amount calculating unit Similarity calculation means for calculating the similarity between the feature quantity of the document part and the feature quantity stored in the rule feature quantity storage means, and based on the similarity calculated by the similarity calculation means, the document part A controller that extracts a rule sentence similar to the document part extracted by the extracting unit and extracts control information related to the rule sentence based on the association. An information processing program for causing to function as Le information extraction means.

  According to the information processing apparatus of the first aspect, when a new rule document is generated, it is possible to extract a past risk in a business activity that may be related to the rule document.

  According to the information processing apparatus of the second aspect, it is possible to easily extract the risk from the rule text in the rule document as compared with the case where the present configuration is not provided.

  According to the information processing apparatus of the third aspect, it is possible to prevent extracting unnecessary risks for the user.

  According to the information processing program of the fourth aspect, when a new regulation document is generated, it is possible to extract a past risk in a business activity that may be related to the regulation document.

  According to the information processing apparatus of the fifth aspect, when a new regulation document is generated, it is possible to extract past controls in business activities that may be related to the regulation document.

  According to the information processing apparatus of the sixth aspect, the control can be easily extracted from the rule text in the rule document as compared with the case where this configuration is not provided.

  According to the information processing apparatus of the seventh aspect, it is possible to prevent the control unnecessary for the user from being extracted.

  According to the information processing program of the eighth aspect, when a new regulation document is generated, it is possible to extract past controls in business activities that may be related to the regulation document.

It is a conceptual module block diagram about the structural example of this Embodiment. It is a module block diagram which shows the more specific structural example in the case of implement | achieving this Embodiment. It is a flowchart which shows the process example which registers the feature-value of a rule sentence. It is explanatory drawing which shows the example of a data structure of a process information table. It is explanatory drawing which shows the data structure example of a risk table. It is explanatory drawing which shows the example of a data structure of a control table. It is explanatory drawing which shows the data structure example of a feature-value table. It is a flowchart which shows the process example which extracts the risk relevant to a rule sentence. It is explanatory drawing which shows the example of presentation of a notification screen. It is explanatory drawing which shows the example of presentation of a risk control creation screen. It is a block diagram which shows the hardware structural example of the computer which implement | achieves this Embodiment.

First, financial internal control will be described as an example of corporate control activities that are the subject of this embodiment.
In recent years, financial internal control has been required. With regard to the financial internal control, “Internal Control – Integrated Framework” announced by COSO (Treadway Committee Organizing Committee) in 1992 has become the de facto standard.・ Board of Directors, Management and other organizations intended to provide reasonable assurance to achieve three objectives: efficiency, (2) reliability of financial statements, and (3) compliance with relevant laws and regulations. It is defined as "one process carried out by staff".
In order to carry out financial internal control, the relationship between activities / systems / resources / knowledge information is organized and business processes (hereinafter simply referred to as processes or business activities) are documented, and those documents are utilized and evaluated (maintenance evaluation, A system for operational evaluation) is established.

First, “Basic 4 Documents” of internal control to be documented will be described.
The four basic documents are basic documents created for each business process subject to internal control. Specifically, business description, business flow diagram, RCM (risk control matrix), separation of duties There is a table.
The business description is also called narrative. This is a documented flow of a series of operations from the start of the transaction to the final entry to the general ledger and reporting. Regulatory documents such as personnel regulations and accounting business regulations are higher-level documents of the business description, and the revision affects the business description. The business manual is a sub-document of the business description and is affected by the revision.
The business flow diagram is a visual flowchart of a series of business flows from the start of a transaction to the final entry to the general ledger and reporting. Risk and control are also placed in this workflow.
The RCM is a summary table of internal control activities related to business processes, the key control points (assertions) to be achieved, the assumed risks, and the corresponding internal control activities.
The segregation of duties table is used to check whether there is a duplication of processing by the same person in charge that causes a financial control problem in the flow of business processes.
Assertion is a precondition for financial information to be considered as reliable information. Specifically, it includes reality, completeness, evaluation, rights and obligations, period / allocation, and display. Items are commonly used. However, it may be partially changed, that is, customized by each company or audit corporation, and is not necessarily limited to the above-mentioned six items.
Risk refers to an impediment to assertions assumed in business processes.
Control (control) refers to internal control activities against risks. Control types include preventive and detective.

Hereinafter, an example of a preferred embodiment for realizing the present invention will be described with reference to the drawings.
FIG. 1 shows a conceptual module configuration diagram of a configuration example of the present embodiment.
The module generally refers to components such as software (computer program) and hardware that can be logically separated. Therefore, the module in the present embodiment indicates not only a module in a computer program but also a module in a hardware configuration. Therefore, the present embodiment also serves as an explanation of a computer program, a system, and a method. However, for the sake of explanation, the words “store”, “store”, and equivalents thereof are used. However, when the embodiment is a computer program, these words are stored in a storage device or stored in memory. It is the control to be stored in the device. In addition, the modules correspond almost one-to-one with the functions. However, in mounting, one module may be composed of one program, or a plurality of modules may be composed of one program. A plurality of programs may be used. The plurality of modules may be executed by one computer, or one module may be executed by a plurality of computers in a distributed or parallel environment. Note that one module may include other modules. Hereinafter, “connection” is used not only for physical connection but also for logical connection (data exchange, instruction, reference relationship between data, etc.).
In addition, the system or device is configured by connecting a plurality of computers, hardware, devices, and the like by communication means such as a network (including one-to-one correspondence communication connection), etc., and one computer, hardware, device. The case where it implement | achieves by etc. is included. “Apparatus” and “system” are used as synonymous terms. “Predetermined” means that the process is determined before the target process, and not only before the process according to this embodiment starts but also after the process according to this embodiment starts. In addition, if it is before the target processing, it is used in accordance with the situation / state at that time or with the intention to be decided according to the situation / state up to that point.

  The information processing apparatus according to the present embodiment extracts a risk candidate in internal control from a new rule document 100. As shown in FIG. 1, a document part extraction module 110, a similarity calculation module 120, a rule. It has a feature DB 130, a risk candidate extraction module 140, a risk candidate presentation module 150, and a process DB 160.

  New regulations document 100 includes, for example, newly created or revised internal regulations, laws and regulations, and regulations documents that must be applied when conducting new business activities or expanding business activities. To do. The new regulation document 100 is an electronic document created by a document creation program or the like.

  The document part extraction module 110 is connected to the similarity calculation module 120, receives the new rule document 100, and extracts the document parts constituting the new rule document 100. Then, the extracted document part is transferred to the similarity calculation module 120. For example, if the new regulation document 100 is a structured document such as XML (extensible Markup Language), it is a sentence divided into parts by tags or the like (for example, a sentence delimited by chapters, sections, terms, etc.) One sentence or a plurality of sentences) is taken out as a document part. Also, for unstructured documents, document parts may be extracted using a technique such as morphological analysis.

The similarity calculation module 120 is connected to the document part extraction module 110, the rule feature DB 130, and the risk candidate extraction module 140, and is stored in the document part and rule feature DB 130 extracted by the document part extraction module 110. The similarity with the feature amount is calculated. That is, the feature amount of the document part (sentence, etc.) of the new regulation document 100 that is the target extracted by the document part extraction module 110 is calculated. Based on the calculated feature amount and the feature amount of the rule sentence in the rule feature amount DB 130, the similarity between the two is calculated. Here, the similarity will be described as a high value when similar.
The rule feature DB 130 is accessed from the similarity calculation module 120 and stores in advance a feature value related to a rule sentence in the rule document and an association between the rule sentence and risk information. For example, specifically, the feature quantity related to the rule text in the rule document used as the basis for creating the control-related item in the business activity, and the relation between the rule text and the control are stored. As the rules and regulations here, among the documents already created in business activities (for example, four basic documents in internal control, etc.), the provisions and the like used as the basis for defining the control are applicable.

  The risk candidate extraction module 140 is connected to the similarity calculation module 120, the risk candidate presentation module 150, and the process DB 160, and is extracted by the document part extraction module 110 based on the similarity calculated by the similarity calculation module 120. A rule sentence similar to the document part is extracted, and a risk related to the rule sentence is extracted based on the association stored in the rule feature DB 130. For example, specifically, when the similarity calculated by the similarity calculation module 120 is equal to or greater than a predetermined threshold, a control related to a rule sentence having the feature amount is extracted from the rule feature amount DB 130, and A risk corresponding to the control may be extracted from the process DB 160, and a risk related to the document part extracted by the document part extraction module 110 may be extracted based on the importance of the risk. Furthermore, you may make it determine the importance of a risk based on the influence degree or possibility of occurrence of the risk memorize | stored in process DB160. Here, the importance is described here as a high value when it is important.

The process DB 160 is accessed from the risk candidate extraction module 140, and stores information related to correspondence between control and risk, and importance of risk. Furthermore, the influence degree or possibility of occurrence of the risk may be stored.
The risk candidate presentation module 150 is connected to the risk candidate extraction module 140 and presents a risk candidate received from the risk candidate extraction module 140 as a risk associated with the new rule document 100. For example, the order of presentation may be determined according to the importance of risk. More specifically, it is presented in order (descending order) in descending order of importance.

  FIG. 2 is a module configuration diagram showing a more specific configuration example in the case of realizing the present embodiment. Similarity calculation module 120, rule feature DB 130, risk candidate extraction module 140, process DB 160, rule document DB 200, control document creation module 210, control rationale extraction module 220, rule feature value extraction module 230, rule document creation module 240, rule A registration monitoring module 250 is included.

  The control document creation module 210 has a risk management module 215, and is connected to the risk candidate extraction module 140, the process DB 160, and the control basis extraction module 220. The control document creation module 210 creates, for example, the above-described basic four documents of internal control using the data in the process DB 160, the risk candidates received from the risk candidate extraction module 140, and the like according to the operation of the user. The created document is also stored in the process DB 160 or the like. In particular, the risk management module 215 is involved in creating a business flow related to risk in the document and setting risk / control. For example, when setting the control, the risk management module 215 specifies a rule document that is a basis for the control and a rule sentence in the rule document in accordance with a user operation. For example, setting a link for associating the control with the rule text in the rule document on which the control is based corresponds. Then, a rule document designated as a control and a link to the rule text in the rule document are passed to the control rationale extraction module 220. The risk management module 215 also has the function of the risk candidate presentation module 150 shown in the example of FIG.

The control basis extraction module 220 is connected to the rule document DB 200, the control document creation module 210, and the rule feature value extraction module 230. The control rationale extraction module 220 receives the control, the rule document corresponding to the control and the link to the rule sentence from the risk management module 215, and extracts the rule document and the rule sentence from the rule document DB 200. Then, the control, the extracted rule document and the rule sentence are passed to the rule feature amount extraction module 230.
The regulation feature quantity extraction module 230 is connected to the regulation feature quantity DB 130 and the control basis extraction module 220. The rule feature value extraction module 230 receives the control document and the rule text extracted from the control basis extraction module 220, extracts the feature values, and stores them in the rule feature value DB 130. Examples of feature amount extraction include, for example, extracting a predetermined keyword using text processing, obtaining the number of keywords, quantifying based on dependency, etc. using morphological analysis, etc. There is.

The regulation document creation module 240 is connected to the regulation document DB 200, creates a regulation document according to a user's operation, and registers it in the regulation document DB 200.
The regulation document DB 200 is accessed from the control rationale extraction module 220, the regulation document creation module 240, and the regulation registration monitoring module 250. It is a document database that stores the regulation document created by the regulation document creation module 240.
The regulation registration monitoring module 250 is connected to the similarity calculation module 120 and the regulation document DB 200. Whether or not the regulation document is newly registered (including revision) in the regulation document DB 200 is monitored. If the regulation document is newly registered, the target regulation document is transferred to the similarity calculation module 120. The rule registration monitoring module 250 also has the function of the document part extraction module 110 shown in the example of FIG. That is, the rule text in the rule document is extracted as a document part.

The similarity calculation module 120 is connected to the rule feature DB 130, the risk candidate extraction module 140, and the rule registration monitoring module 250. The similarity calculation module 120 receives a document part in the rule document newly registered from the rule registration monitoring module 250, and The above processing is performed.
The rule feature DB 130 is accessed from the similarity calculation module 120 and the rule feature extraction module 230 and stores the feature extracted by the rule feature extraction module 230. As described above, the rule feature DB 130 stores the feature in the similarity calculation module 120. Pass the contents.
The risk candidate extraction module 140 is connected to the similarity calculation module 120, the process DB 160, and the control document creation module 210, performs the above-described processing, and passes the processing result to the control document creation module 210.
The process DB 160 is connected to the risk candidate extraction module 140 and the control document creation module 210, stores a document relating to the control created by the control document creation module 210, and stores the contents to the risk candidate extraction module 140 as described above. hand over.

FIG. 3 is a flowchart illustrating an example of processing for registering a feature amount of a rule sentence.
In step S302, the control document creation module 210 creates a control document in accordance with a user operation. At least the control documents to be created include those related to control settings.
For example, setting a risk and setting a control corresponding to the risk corresponds to describing contents in each column in the process information table 400, the risk table 500, and the control table 600.

FIG. 4 is an explanatory diagram showing an example of the data structure of the process information table 400.
The process information table 400 includes an activity No. Column 410, risk number. Column 420, control No. It has a column 430. Activity No. The column 410 stores an activity number that is a code for uniquely identifying a business activity. Risk No. The column 420 stores a risk number that is a code for uniquely identifying a risk that may occur in the business activity. Control No. The column 430 stores a control number that is a code for uniquely identifying a control corresponding to the risk. This associates risks with controls.

FIG. 5 is an explanatory diagram showing an example of the data structure of the risk table 500.
The risk table 500 is a risk number. A column 510, a risk content column 520, an influence level column 530, and an occurrence possibility column 540; Risk No. The column 510 stores the risk number. The risk content column 520 stores the content of the risk. For example, “the sales person in charge registers a business negotiation in the [negotiation contract] with fictitious or incorrect contents”. The influence degree column 530 stores the influence degree in the business activity when the risk occurs. For example, there are “large”, “medium”, “small”, and the like. The occurrence possibility column 540 stores the frequency of occurrence of the risk in the business activity. For example, there are “large”, “medium”, “small”, and the like.

FIG. 6 is an explanatory diagram showing an example of the data structure of the control table 600.
The control table 600 has a control No. A column 610, a control content column 620, a type (manual / system) column 630, a type (prevention / discovery) column 640, and a rule column 650 as a basis for control. Control No. A column 610 stores a control number. The control content column 620 stores the content of the control. For example, “Customer information / item / sales unit price is registered in [customer master] / [item master] / [price master] in [ERP] and automatically reflected in [negotiation contract system]”. is there. The type (manual / system) column 630 stores whether the operation is performed manually or by the system. The type (prevention / discovery) column 640 stores the type of control. The rule column 650 that becomes the basis of control stores the rule that becomes the basis of the control. For example, the “Regulations for Accounting Regulations” as the regulations document, and “Chapter 2 Handling of Books and Account Organizations” Article 9 Prohibition of Tampering Accounting slips, books and vouchers are smeared, revised, deleted, Do not tamper with stickers or correction fluids. " Note that the rule column 650 that is the basis of control is set in step S306.

In step S304, the risk management module 215 designates a rule document and a rule sentence as a basis for the control setting in accordance with a user operation. When the control is set in creating the control document in step S302, the rule document and the rule sentence that are the basis of the control are specified. More specifically, it is to search and specify the relevant rule document and rule sentence from the rule document DB 200.
In step S306, the control rationale extraction module 220 extracts the rule document and rule sentence specified in step S304 from the rule document DB 200. Then, the name of the extracted rule document (or the rule document code for uniquely identifying the rule document, etc.) and the rule sentence are set in the rule column 650 that is the basis of control in the control table 600.

In step S308, the rule feature value extraction module 230 extracts feature values from the rule document and rule text. For example, it corresponds to extracting a predetermined keyword or the like from the regulation text.
In step S310, the rule feature value extraction module 230 registers the feature value extracted in step S308 in the rule feature value DB. For example, the feature amount is registered in the feature amount table 700.
FIG. 7 is an explanatory diagram showing an example of the data structure of the feature quantity table 700. As shown in FIG. The feature quantity table 700 includes a regulation document No. Column 710, regulation text No. Column 720, keyword column 730, control No. Column 740 is included. Regulation document no. The column 710 stores a regulation document number that is a code for uniquely identifying the regulation document. Regulation text No. The column 720 stores a rule sentence number that is a code for uniquely identifying a rule sentence in the rule document. The keyword column 730 stores a keyword that is a feature amount of the rule sentence. Control No. The column 740 stores a control number based on the rule document and rule text.

FIG. 8 is a flowchart illustrating an example of a process for extracting a risk associated with a rule sentence. That is, when a rule document is newly created, the risk generated in the past related to the rule sentence is extracted as a risk candidate corresponding to the rule sentence.
In step S <b> 802, the document part extraction module 110 extracts a document part from the new rule document 100.
In step S804, the similarity calculation module 120 determines whether there is still a document part extracted in step S802. If there is (Yes), the process proceeds to step S806, and otherwise (No, if the process from step S806 to step S812 is performed on all of the rule texts in the extracted new rule document 100), the process proceeds to step S814. .
In step S806, the similarity calculation module 120 extracts the feature amount of the document part extracted in step S802. A feature quantity is extracted using a method equivalent to the regulation feature quantity extraction module 230. For example, it corresponds to extracting a predetermined keyword or the like from the regulation text.

In step S808, the similarity calculation module 120 calculates the similarity between the feature amount extracted in step S806 and the feature amount of the rule sentence stored in the rule feature amount DB 130.
For example, it is checked how much the keyword obtained by analyzing the rule sentence matches the keyword registered in the rule feature DB 130. If the degree of matching is high, the degree of similarity is considered high.
As an example of the coincidence calculation formula, there is a formula (1).
The degree of coincidence = (number of keywords B) / (number of keywords A + number of keywords B + number of keywords C) (1) Equations A, B, and C are as follows.
A: Number of keywords included in the rule text in the new rule document 100 B: Number of keywords included in both C: Number of keywords included in the rule text in the rule feature DB 130 In addition, in Equation (1), the number of keywords is The number of different keywords may be the number of keywords (A is not in the regulation feature DB 130 but only in the new regulation document 100, and C is the keyword in the regulation feature DB 130 but not in the new regulation document 100). However, the total number of keywords may be used.

Further, the degree of coincidence may be calculated in consideration of the importance of the risk associated with the selected rule sentence in the rule feature DB 130.
Target risk coefficient = f (Risk impact, likelihood of occurrence) Formula (2) Equivalence = (Number of B keywords) / (Number of A keywords + Number of B keywords + Number of C keywords) * Target risk coefficient (3) Formula It should be noted that the function f () in the expression (2) has values (“large”, “medium”, “small”) stored in the influence degree column 530 and the possibility occurrence column 540 of the risk table 500 as arguments. For example, addition may be performed when “large” = 10, “medium” = 5, and “small” = 1.
As a result, although the degree of coincidence increases even though the target risk coefficient is large, more important grounds for control can be listed.
Note that the above-described calculation formula is merely an example, and does not limit the calculation method of the document matching degree.

In step S810, the risk candidate extraction module 140 determines whether the similarity calculated in step S808 is greater than or equal to a predetermined threshold. If it is equal to or greater than the threshold (Yes), the process proceeds to step S812, and otherwise (No), the process returns to step S804.
In step S812, the risk candidate extraction module 140 records the rule text of the object for which the similarity is determined to be greater than or equal to the threshold value in step S810. That is, the rule sentence No. Record the rule sentence number stored in the column 720. Thereafter, the process returns to step S804. In addition, when there are a plurality of rule sentences in the rule feature DB 130 whose similarity is equal to or greater than the threshold value, a plurality of rule sentences to be recorded.

In step S814, the risk candidate extraction module 140 determines whether there is a target rule sentence recorded in step S812. If there is (Yes), the process proceeds to step S816; otherwise, the process ends (step S899).
In step S816, the risk candidate presentation module 150 extracts a control that matches the target rule sentence recorded in step S812. That is, specifically, the rule sentence No. The control No. corresponding to the regulation sentence number in the column 720 is displayed. Extract the control number in column 740. Then, the risk corresponding to the control is extracted. That is, specifically, the risk number corresponding to the control number in the process information table 400 is extracted. Next, the importance corresponding to the risk is calculated. In other words, specifically, the risk No. Information in the influence level column 530 and the possibility column 540 corresponding to the column 510 is extracted, and the importance level of the risk is calculated using the above-described equation (2). And according to the importance, the content which should be notified is produced and notified. That is, specifically, the risk generated in the past related to the rule text in the new rule document 100 is presented as a risk candidate corresponding to the rule text. There may be multiple risks to be presented.

FIG. 9 is an explanatory diagram illustrating a presentation example of the notification screen 900. That is, this is an example presented by the risk candidate presentation module 150 in step S816. The rule text in the newly created rule document is extracted, and the risk control associated with another rule sentence similar to the rule sentence is extracted. Is presented.
The notification screen 900 includes a target rule sentence presentation field 910, a risk presentation table 920, an OK button 931, and a cancel button 932. The target rule sentence presentation column 910 displays a rule sentence that is a document part extracted by the document part extraction module 110. The risk presentation table 920 displays the risk extracted by the document part extraction module 110 related to the rule text displayed in the target rule text presentation column 910 and the corresponding control. For example, items arranged in order of importance of risk, or items having a degree of importance higher than a predetermined threshold may be presented. The risk presentation table 920 has a risk ID column 921, a risk content column 922, a control content column 923, and a confirmation button column 924. When “Confirm” in the confirmation button column 924 is selected by the user's operation, details of the corresponding risk and control contents are displayed.
When the OK button 931 is selected by a user operation, the screen changes to a screen for setting risk control as a control document. If it is determined by the newly generated rule text that the corresponding new risk control setting is unnecessary, the cancel button 932 is selected by the user's operation, and the notification screen 900 is closed.

FIG. 10 is an explanatory diagram showing a presentation example of the risk control creation screen 1000. That is, this is an example presented by the risk candidate presentation module 150 in step S816. The rule text in the newly created rule document is extracted, and the risk control associated with another rule sentence similar to the rule sentence is extracted. As a reference for the generation of risk controls associated with the statement.
The risk / control creation screen 1000 includes a target rule sentence presentation field 1010, a risk description field 1020, a control description field 1030, a creation button 1041, a cancel button 1042, and a risk presentation table 1050. The target rule sentence presentation column 1010 and the risk presentation table 1050 are equivalent to the target rule sentence presentation column 910 and the risk presentation table 920 of the notification screen 900, respectively. The risk description column 1020 is a column for accepting a risk corresponding to the target rule sentence presentation column 1010 in accordance with a user operation. The control description column 1030 is a column for receiving a control corresponding to the target rule sentence presentation column 1010 according to the user's operation.
When the creation button 1041 is selected by the user's operation, the risk control corresponding to the rule text presented in the target rule text presentation field 1010 is set as a control document. If it is determined by the newly generated rule text that the corresponding new risk control setting is unnecessary, the cancel button 1042 is selected by the user's operation, and the risk control creation screen 1000 is closed.

  Note that the hardware configuration of the computer on which the program according to the present embodiment is executed is a general computer as illustrated in FIG. 11, specifically a personal computer, a computer that can be a server, or the like. That is, as a specific example, the CPU 1101 is used as a processing unit (calculation unit), and the RAM 1102, the ROM 1103, and the HD 1104 are used as storage devices. For example, a hard disk may be used as the HD 1104. A CPU 1101 that executes programs such as a document part extraction module 110, a similarity calculation module 120, a risk candidate extraction module 140, a control rationale extraction module 220, and a regulation feature quantity extraction module 230, a RAM 1102 that stores the program and data, a book ROM 1103 storing a program for starting the computer, an auxiliary storage device HD 1104, an input device 1106 for inputting data such as a keyboard and a mouse, an output device 1105 such as a CRT or a liquid crystal display, and a network A communication line interface 1107 for connecting to a communication network such as an interface card, and a bus 1108 for connecting them to exchange data. A plurality of these computers may be connected to each other via a network.

Among the above-described embodiments, the computer program is a computer program that reads the computer program, which is software, in the hardware configuration system, and the software and hardware resources cooperate with each other. Is realized.
Note that the hardware configuration illustrated in FIG. 11 illustrates one configuration example, and the present embodiment is not limited to the configuration illustrated in FIG. 11, and is a configuration capable of executing the modules described in the present embodiment. I just need it. For example, some modules may be configured by dedicated hardware (for example, ASIC), and some modules may be in an external system and connected via a communication line. A plurality of systems shown in FIG. 5 may be connected to each other via communication lines so as to cooperate with each other. In particular, in addition to personal computers, information appliances, copiers, fax machines, scanners, printers, and multifunction machines (image processing apparatuses having two or more functions of scanners, printers, copiers, fax machines, etc.) Etc. may be incorporated.

In the above-mentioned embodiment, it was shown that the risk importance level is calculated by a function using the risk impact level and the possibility of occurrence as arguments. However, a new risk is set on the risk control creation screen 1000 or the like. Alternatively, the calculation may be performed based on the number of times selected.
In addition, when the similarity is similar, the importance is described as showing a high value when it is important, but the opposite value (for example, when the similarity is similar, the value of the similarity is low) is shown. There may be.
Further, in the description of the embodiment, in the comparison with a predetermined value, “more than”, “less than”, “greater than”, “less than (less than)” is inconsistent in the combination. As long as it does not occur, “larger”, “smaller (less than)”, “more”, and “less” may be used.
Moreover, although demonstrated using a numerical formula, the thing equivalent to the numerical formula is contained in a numerical formula. The equivalent includes not only the mathematical formula itself, but also transformation of the mathematical formula to the extent that the final result is not affected, or solving the mathematical formula by an algorithmic solution.
In the above-described embodiment, an example is shown in which a risk is extracted and then a control corresponding to the risk is extracted. However, after extracting a control, a risk corresponding to the control may be extracted. Good. That is, in the above-described embodiment, the risk and the control may be replaced and read. For example, the rule feature DB 130 stores in advance a feature value related to a rule sentence in the rule document and an association between the rule sentence and control information. The risk candidate extraction module 140 (note that the module name has not been changed) generates a rule sentence similar to the document part extracted by the document part extraction module 110 based on the similarity calculated by the similarity calculation module 120. At the same time, the control related to the rule sentence is extracted based on the association stored in the similarity calculation module 120. The process DB 160 stores information related to the correspondence between controls and risks and the importance of the controls. The risk candidate presentation module 150 presents control candidates received from the risk candidate extraction module 140 as controls related to the new rule document 100.

The program described above may be provided by being stored in a recording medium, or the program may be provided by communication means. In that case, for example, the above-described program may be regarded as an invention of a “computer-readable recording medium recording the program”.
The “computer-readable recording medium on which a program is recorded” refers to a computer-readable recording medium on which a program is recorded, which is used for program installation, execution, program distribution, and the like.
The recording medium is, for example, a digital versatile disc (DVD), which is a standard established by the DVD Forum, such as “DVD-R, DVD-RW, DVD-RAM,” and DVD + RW. Standard “DVD + R, DVD + RW, etc.”, compact disc (CD), read-only memory (CD-ROM), CD recordable (CD-R), CD rewritable (CD-RW), Blu-ray disc ( Blu-ray Disc (registered trademark), magneto-optical disk (MO), flexible disk (FD), magnetic tape, hard disk, read-only memory (ROM), electrically erasable and rewritable read-only memory (EEPROM), flash Includes memory, random access memory (RAM), etc. .
The program or a part of the program may be recorded on the recording medium for storage or distribution. Also, by communication, for example, a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a wired network used for the Internet, an intranet, an extranet, etc., or wireless communication It may be transmitted using a transmission medium such as a network or a combination of these, or may be carried on a carrier wave.
Furthermore, the program may be a part of another program, or may be recorded on a recording medium together with a separate program. Moreover, it may be divided and recorded on a plurality of recording media. Further, it may be recorded in any manner as long as it can be restored, such as compression or encryption.

DESCRIPTION OF SYMBOLS 100 ... New rule document 110 ... Document component extraction module 120 ... Similarity calculation module 130 ... Rule feature-value DB
140 ... Risk candidate extraction module 150 ... Risk candidate presentation module 160 ... Process DB
200 ... Rule document DB
210 ... Control document creation module 215 ... Risk management module 220 ... Control basis extraction module 230 ... Rule feature extraction module 240 ... Rule document creation module 250 ... Rule registration monitoring module

Claims (8)

A rule feature value storage means for storing a feature value related to a rule sentence in the rule document and an association between the rule sentence and risk information;
A document part extracting means for extracting a document part constituting the document from a document relating to the regulations;
Document part feature amount calculating means for calculating the feature amount of the document part extracted by the document part extracting means;
Similarity calculation means for calculating the similarity between the feature quantity of the document part calculated by the document part feature quantity calculation means and the feature quantity stored in the rule feature quantity storage means;
Based on the similarity calculated by the similarity calculation means, a rule sentence similar to the document part extracted by the document part extraction means is extracted, and risk information related to the rule sentence is extracted based on the association. An information processing apparatus comprising risk information extracting means for extracting. Risk-related information storage means for storing information related to control and risk correspondence and risk importance,
The rule feature value storage means stores a feature value related to a rule text in a rule document used as a basis for creating an item related to control, and a relation between the rule text and the control.
The risk extraction unit extracts a control related to the rule sentence from the rule feature amount storage unit based on the similarity calculated by the similarity calculation unit, and corresponds to the control from the risk related information storage unit. The information processing apparatus according to claim 1, wherein a risk is extracted, and a risk related to the document part extracted by the document part extraction unit is extracted based on the importance of the risk. The risk related information storage means stores the degree of risk impact or possibility of occurrence,
The information processing apparatus according to claim 2, wherein the risk extraction unit determines the importance level of the risk based on an influence degree or possibility of occurrence of the risk stored in the risk related information storage unit. . Computer
A rule feature value storage means for storing a feature value related to a rule sentence in the rule document and an association between the rule sentence and risk information;
A document part extracting means for extracting a document part constituting the document from a document relating to the regulations;
Document part feature amount calculating means for calculating the feature amount of the document part extracted by the document part extracting means;
Similarity calculation means for calculating the similarity between the feature quantity of the document part calculated by the document part feature quantity calculation means and the feature quantity stored in the rule feature quantity storage means;
Based on the similarity calculated by the similarity calculation means, a rule sentence similar to the document part extracted by the document part extraction means is extracted, and risk information related to the rule sentence is extracted based on the association. An information processing program which functions as a risk information extracting means for extracting. A rule feature value storage means for storing a feature value related to a rule sentence in the rule document and an association between the rule sentence and control information;
A document part extracting means for extracting a document part constituting the document from a document relating to the regulations;
Document part feature amount calculating means for calculating the feature amount of the document part extracted by the document part extracting means;
Similarity calculation means for calculating the similarity between the feature quantity of the document part calculated by the document part feature quantity calculation means and the feature quantity stored in the rule feature quantity storage means;
Based on the similarity calculated by the similarity calculation means, a rule sentence similar to the document part extracted by the document part extraction means is extracted, and control information related to the rule sentence is extracted based on the association. An information processing apparatus comprising control information extracting means for extracting. Control-related information storage means for storing information related to control and risk correspondence and control importance, and
The rule feature amount storage means stores a feature amount related to a rule sentence in a rule document used as a basis for creating an item relating to risk, and a relation between the rule sentence and the risk,
The control extraction unit extracts a risk related to the rule sentence from the rule feature amount storage unit based on the similarity calculated by the similarity calculation unit, and corresponds to the risk from the control related information storage unit The information processing apparatus according to claim 5, wherein a control is extracted, and a control related to the document part extracted by the document part extraction unit is extracted based on the importance of the control. The control related information storage means stores the degree of influence or possibility of occurrence of control,
The information processing apparatus according to claim 6, wherein the control extraction unit determines the importance level of the control based on an influence degree or occurrence possibility of the control stored in the control related information storage unit. . Computer
A rule feature value storage means for storing a feature value related to a rule sentence in the rule document and an association between the rule sentence and control information;
A document part extracting means for extracting a document part constituting the document from a document relating to the regulations;
Document part feature amount calculating means for calculating the feature amount of the document part extracted by the document part extracting means;
Similarity calculation means for calculating the similarity between the feature quantity of the document part calculated by the document part feature quantity calculation means and the feature quantity stored in the rule feature quantity storage means;
Based on the similarity calculated by the similarity calculation means, a rule sentence similar to the document part extracted by the document part extraction means is extracted, and control information related to the rule sentence is extracted based on the association. An information processing program which functions as a control information extracting means for extracting.

Images